SCAMS IN CRYPTO & HOW TO RECOGNIZE THEM

[Ca$hmaker]

Hello everybody,

because I have read it here more often, I thought that a thread on the subject would not be a wrong idea.
Cryptocurrency scams are becoming harder to detect. Here are a few things to watch out for


Disclaimer:
The scams listed here are not exhaustive, are merely examples, and are intended to give an idea of the ways in which scammers attempt to gain value.


As cryptocurrencies such as Bitcoin and Ethereum are gaining in popularity, the number of scams and scams in this area is also increasing. However, there are also some things that you can (and should) pay attention to when dealing with the subject and where money and/or personal information is in any way at stake.

Overview:
Part 1 - Websites
Part 2 - Twitter
Part 3 - Airdrops
Part 4 - Signal Groups (Pump & Dump)
Part 5 - Scam Mails

Before you go, the most important tip is the Golden Rule: NEVER reveal your private keys, NEVER - for any reason, no matter how tempting!

In addition, greed is one of your biggest enemies. If you are greedy and take too little care of yourself, you can lose everything. So be careful!


Part 1 - Websites

Situation / Danger:
A now popular scam is the cloning of a well-known website to get the unsuspecting user to enter their data and steal it.

Usually you can tell by the presence of the green "https" in front of the URL if a website is legitimate.


https://ip.bitcointalk.org/?u=https%3A%2F%2Fi.imgur.com%2F3EKZzpt.png&t=588&c=JycNRYO5CG5NAw

If you are attentive, you can easily see that the next page is not a legitimate site or a legitimate entity because it does not have the proper certification to be trusted.

So you always have to look for a green "Safe" or "Secure" and "https" in front of the URL address of the website. This is a sign that the website and the company have received the proper Secure Sockets Layer (SSL) certificates. Obtaining an SSL certificate indicates that the company can be trusted behind the page.




Coinsmarkets.com has neither the green "Secure" nor "https" in front of its URL. Instead, it has a gray "Not Secure" and a regular "http" in front of the URL.
As a rule, scam pages are quickly detected and removed. If you are now trying coinsmarkets.com (please do not wink) you will get an error message.


However, some scam sites have found a way to display the green "secure" and "https" in the website URL, and then make an incredibly subtle change to the URL.




At first glance, URL for the popular cryptocurrency exchange Binance seems legitimate. You can clearly see the green "https" in front of the website URL and also the name seems to be correct.

In the rarest cases, it is understandable how a site received an SSL certificate that allows them to display the green "https" in front of the URL. This also applies to scammer pages. At the same time, getting an SSL certificate from a less trusted certificate issuer is pretty easy.

If you take a closer look at the second picture, you will see small dots under the letters "n" in the word "binance".

The two dots under the Binance URL show that this is not the real Binance page. Instead, it's a very well-made clone of the page, whose sole purpose is to tap user data that unsuspecting users enter there. Even an activated 2FA authentication does not protect you, since a scammer can enter this data immediately after you have entered it on the real Binance page, where it will still be valid. Thus, he has access to the account from then on.

Especially perfidious are those pages that show an error message after the first log in, saying: "The service can not be reached temporarily, please try again in 10 minutes." In this way, the user does not even suspect that he has just revealed his data and a scammer uses it to gain access to the user's account.
If the user then tries to log back in 10 minutes later, he gives the scammer a 2. 2FA code, which he may use to initiate a transaction or even disable 2FA.

Even if you are attentive, such a site can be difficult to spot because everything seems familiar at first glance.

The example shown here is called PunyCode, which is used to create certain special characters (here the dot under the letter "n")
In another example, we linked to Bittrex and used the cedilla under the "r" (looks like a comma). Cedillas are widely used in languages such as French and Portuguese.




Part 2 - Twitter

Situation / Danger:
Another popular method is to fake known accounts on Twitter and, under cover of a giveaway or airdrop, encourage people to send money or crypto.



Here you can see very well that in the red box (Scam) the Twitter name is "binance", but the handle is "@ banance_2017" and not like in the green box "@ binance_2017". Here, a giveaway of Binance is faked and the link to an ether address is given to which ETH is to be sent to participate in the giveaway. In the orange box you can see that the post office has been split and licked very often, which should give the whole thing credibility, as are the fake confirmations in the blue boxes. These were also placed by the scammers. The high number of shares & likes is most likely due to the use of bots.

Another scam are fake accounts, which get the "verified" from Twitter including the blue hook next to the name, which - if you are not hellish beware - can lead you astray very quickly. Here's an example:



It can be seen that the TRON project's real account (right) has a blue check mark next to its name. The handle is "@Tronfoundation". On the left, however, is the fake account, which also has a blue hook next to the name, but a slightly different handle "@Tronfoundationl".

The confusing thing: The fake account has the completely identical description, location and a similar follower number AND he is even older, which means that you theoretically even keep the original account for the fake account, since this is only a few months old.

So, if you look at the following tweet, there is not much to say against it that you can consider it authentic:







Tips:
- Just make it a policy to NEVER join a giveaway where you have to invest money first.
- NEVER enter your private key somewhere and do not upload it (eg JSON file).
- Followed the most important Twitter accounts you use regularly
- If you see a message that interests you, go to the Twitter feed of the account and look there to see if the message really comes from the real account.


Part 3 - Airdrops

Situation / Danger:
Airdrops are now performed in various ways. Therefore, it is also difficult to show all possible scam combinations. What most Airdrop scams have come to grips with is that they somehow try to get hold of your private keys - either on a website or in a (Google) form.

Prominent example is the Fake-OmiseGo Airdrop:



In the screenshot above it is easy to see that in each case the third field asks for your private key. The following sentences are particularly perfidious: "Note: It is safe We will never collect or store your personal information (such as your private key) This form is fully encrypted ...". In addition, this is an unnecessary complexity suggests, while the scammers have it only on your private key apart.

The links to such sites are distributed via Twitter & Facebook but also via telegram and other channels such as Slack or Discord. Often an urgency is also suggested (for example "only the first 1,000 participants), so that the alleged victims become careless.

Tips:
-NEVER give your private key! (you can not repeat it often enough)
-If you want to join in an Airdrop, first check the project! Do not use a direct link from the same source. Looking for a homepage and a bounty thread here in Bitcointalk
-If you do not find anything, it is most likely a scam
-Use your common sense, because here too in the forum there are questionable projects and practices.


Part 4 - Signal Groups (Pump & Dump)

Situation / Danger:
Undertow. Signal Groups and Pump & Dump Groups are a great danger, especially for newcomers, as they suggest quick profits and often present them credibly.



Tips:

-Avoid short term pumps & dumps, without extensive research and experience it is pure gambling and losses are almost guaranteed.
-Never spend money to get into "closed groups" or receive so-called paid signals. You usually come in the paid outer circle >> 75% loss!
-Watch out for supposed "insider tips" that are being dropped. These are almost always coins that are in the pumping phase. If you get in here, you're the one who's dumped on.


Part 5 - Scam Mails

Situation / Danger:
Phishing and Scam emails have been known for years and are actually nothing new. Due to the often prevailing intransparency in Crypto and the unawareness / insecurity of many, it is still worth mentioning. In addition, scam websites (see above) may irreversibly compromise accounts / wallets and therefore pose a particular danger. Especially in combination with Airdrops and the often difficult-to-understand coin-token distribution practices, the danger of scam / phishing emails is omnipresent.

On the left a "classic" phishing mail, on the right a scam mail that applies for a nonexistent Airdrop:



There is not much to say about scam emails. They work on the same principle as previous phishing emails and try to convince you credibly that they are authentic. This is unfortunately favored by the fact that many projects are relatively unprofessional and therefore supposedly scam mails actually come sometimes from the actual project. As a result, laypersons (and even experienced users) often find it difficult to spot the difference directly.

Tips:

-Create at least 1 new e-mail address for Crypto. Be selective on whom you give this address.
-Never respond to mails that have not requested yours. Especially not if you have not given the project / sender your e-mail address.
-Do not click on links in emails! Should you do it, use a e.g. sandbox
-If you are unsure about a mail, verify the information (not by clicking in the mail!), Eg. Search the project's Twitter, Telegram, or other social media channels.

[1713587144]

1713587144

[mkumar76]

good info on various scams .
most shocking part i seen is in twitter where people somehow get verified twitter handle and then do scam with that .
people take verified symbol as authenticity of that handle .
dont know why twitter not take action on such handles .

one more thing is with google search .
yday i was trying to search a ico website and in search results i found scam website at top in ad category with same ICO name.
no one can differentiate which is fake and people new in crypto and unaware of such scams are mostly victims .

[Tugsukana]

thank you for the imformation you give this is very helpfull  so much to don't get involve of the shit scammers ..

[jackjackfly]

Man this is really handy post made by you. Very useful for many newbies to understand this basics of scamming people, how it happens and who is doing so. If you have som other handy stuff written, please share links!

[Orrechorre]

With this information, people should be able to recognize scam when they see one and how best to keep their information to avoid being scammed. Thank you very much for taking your time to give this very helpful information because many people will benefit from it.

[Ca$hmaker]

Thank you for your positive feedback. Ideas and suggestions are welcome. Should I add something or miss something, let me know. 

For one or the other merit I would be happy so I'll be able to upload pictures

[[Frederick]]

to summarize things up, don't join anything that something odds about them like asking money first and saying it's free airdrops, haha. Private key sharing and encouraging is the most stupid thing a wallet holder can do.

[bitcoin.beda]

Very good detail for detecting scams crypto or ICO, i will just to add to on my personal experience on how to detect them is by checking the members the team as well their social media account if they are claiming to be part of the project. For me thats the best way to check if the crypto is genuine or not

[Wipro]

Very good detail for detecting scams crypto or ICO, i will just to add to on my personal experience on how to detect them is by checking the members the team as well their social media account if they are claiming to be part of the project. For me thats the best way to check if the crypto is genuine or not

This one of the way to catch the legit project or not with the social account mate. I see the ICO projects are really helpful for the people looking to make the investment double after the tokens listed on the exchange dude.
Please read the white paper first and then confirm who are all the experienced devs part of the project.
I mostly looking into these information only. If all set good only even I go participate in their bounty campaign.

[Ca$hmaker]

Edited.

[slaman29]

Helpful, nice to see someone do something like this. Merited your post. Unfortunately, all these examples won't stop the scams, and people still need to learn to practice good behavior online and understand first how to even prevent themselves from ever facing a situation where they have to check website names and identify scams.

Add the tip for Website scams to bookmark sites often used after verifying they are correct. And only access from bookmarks. Google search is such a dangerous thing I never use it for going to websites.

[Osakrita]

It is amazing to note the volume of useful information packed into this post. Thanks for sharing this on the forum.Phishing websites are a real problem,one has to be extremely care to check out the sites especially exchanges before inputing personal details.It is also good practice to include email verification in withdrawals since 2FAs can be fooled as indicated in the post

[milewilda]

Helpful, nice to see someone do something like this. Merited your post. Unfortunately, all these examples won't stop the scams, and people still need to learn to practice good behavior online and understand first how to even prevent themselves from ever facing a situation where they have to check website names and identify scams.

Add the tip for Website scams to bookmark sites often used after verifying they are correct. And only access from bookmarks. Google search is such a dangerous thing I never use it for going to websites.

This post doesnt really have the intention on completely stopping scams but rather it do only spreads awareness and given out some illustrations which is really helpful into newbie or people who are just getting in recently either engaging into bounties or directly investing into those projects in the market. Recognizing them would really be just simple by just doing simple routine or indications which even you common sense would able to point out if those project are fraud or legit.

[zfrey]

the information you share really contains very useful information for many people. Congratulations for sharing nice content. It's good to see such shares.

[fleer]

scammers love telegram chats over discord

[jrrsparkles]

This is very good post to get the idea about scams and legits in the crypto field but the sad thing is that the scammers are getting updated everyday and make the site looks so original so we also need to get updated with the news about the crypto currency field to avoid any scams and while login to sites it is better to login from bookmarked page to avoid the close sites.

[fleer]

I tell you what, it's easiest to think everything is a scam

[indrofx78]

good information, to be more careful in Crypto. especially to avoid scammers.

and I am sure that all those who jump into the world of crypto must have experienced it.

I myself too, but this I made a lesson for me so I am more careful and careful.

[ryancpk]

Nice compilation of ways to detect scam.

[Thanasis]

Some users here got scam already because they create same username and email in different site so better not to do that then we should create new username and password if you afraid to create new one because that's hard to save i suggest to write your username and password to notebook then save in telegram then for more good try to save also in social site

Yes,it is better to have separate email address for participating in bounties and use different kind of passwords to save ourselves from scammers.Better to keep the passwords not in digital form because the phishing links can copy our clipboard.

[irsada]

perhaps with posts like this give awareness for us if you want to do something in the world of crypto must be careful in every step.

[Mahanton]

Some users here got scam already because they create same username and email in different site so better not to do that then we should create new username and password if you afraid to create new one because that's hard to save i suggest to write your username and password to notebook then save in telegram then for more good try to save also in social site

Yes,it is better to have separate email address for participating in bounties and use different kind of passwords to save ourselves from scammers.Better to keep the passwords not in digital form because the phishing links can copy our clipboard.

Ive been doing this after i do experience last time when my main email been hacked i dont know how it happened but im now careful on engaging to things which i do have email registered on each own bounties and airdropts.

For the post and OP, this deserves merit for all the effort being putted on here where do make warnings for those people when it comes to potential type of scamming attempts.There are lots of ways thats why we should really have an eagle-eye type of eyes. hahaha

[jvdp]

Some users here got scam already because they create same username and email in different site so better not to do that then we should create new username and password if you afraid to create new one because that's hard to save i suggest to write your username and password to notebook then save in telegram then for more good try to save also in social site

Using multiple accounts on where you mean bro, If you want to exchange on the altcoins in the trading site I am not sure what is wrong in that. If you want to create the multiple accounts at this forum means that is advisable and not tolerated too.

I think scam op asked and you have mentioned both are different only mate.
Then scam in ICO project may here from the bounties and then investment over any airdrops and etc...

[Ca$hmaker]

Thank you guys!
I'll update this thread.

[Ca$hmaker]

Update: In the next days I'll add "Pyramid and Ponzi Schemes"
Stay tuned!

[Ca$hmaker]

Part 6 - Pyramide & Ponzi Schemes

The Ponzi scheme (similar to the Ponzi scheme) is a supposedly lucrative investment in money, but it only works if there is continuous fresh money flowing into the system, which is usually only possible through newcomers.

The Ponzi scheme can be identified by various factors, including: on the guaranteed return. As long as new investors join in, the system works. In this case, sufficient capital will be available to disburse existing investors as long as they do not withdraw and reclaim the investment.

A well-known example is BitConnect:
BitConnect promised to take Bitcoin Investing to another level and open it up to everyone. For this, the makers behind BitConnect have introduced their own Coin, the BitConnect Coin (BCC), and a few months later the BitConnect Lending platform. With the platform, it was possible to invest in automated Bitcoin trading and benefit from daily distributions.

As you can see very well in the following picture, BitConnect profits are above average (even if the return on Crypto can be higher) - 40% per month for a passive system is unrealistic.





It is very easy to see what happens when the system collapses.
The danger with this project was that many - also known - creators, influencers and Twitterers actively promoted the project and presented it as an ideal source of income. Why? Because they used their referral codes and were thus rewarded for every new user. In the end, the followers paid dearly their trust in those.


Tips:
Researched projects in which you want to invest (DYOR - do your own research) and do not trust anyone blindly, no matter who in your environment is just totally convinced of a project.
Have no unrealistic profit expectations, no one gives you money
If you do not understand a system or project, do not invest in this project.

[stomachgrowls]

Tips:
Researched projects in which you want to invest (DYOR - do your own research) and do not trust anyone blindly, no matter who in your environment is just totally convinced of a project.
Have no unrealistic profit expectations, no one gives you money
If you do not understand a system or project, do not invest in this project.

Some people are already aware on this kind of thing but they do still decide to continue on what they are doing just for the sake of earning easy returns on a short possible of time. Recognizing them isnt really too hard and even just with a simple logic and common sense we can really able to identify out. I dont know why some people do make theirselves of their own greed and they do cry out later when they are scammed. Bitcoinnect shit scam is one of the examples, even just seeing it on very first time it is already a scam to me.

[shesheboy]

Tips:
Researched projects in which you want to invest (DYOR - do your own research) and do not trust anyone blindly, no matter who in your environment is just totally convinced of a project.
Have no unrealistic profit expectations, no one gives you money
If you do not understand a system or project, do not invest in this project.

Some people are already aware on this kind of thing but they do still decide to continue on what they are doing just for the sake of earning easy returns on a short possible of time. Recognizing them isnt really too hard and even just with a simple logic and common sense we can really able to identify out. I dont know why some people do make theirselves of their own greed and they do cry out later when they are scammed. Bitcoinnect shit scam is one of the examples, even just seeing it on very first time it is already a scam to me.

why continue even if you know that it is already a scam?  that was a totally dumb and idiotic move to do. but at the end those people that got scammed are only crying without doing nothing for their money because they cant do also anything due to the fact that scammers are verry hard to find and caught online . it was their own mistake anyway , so their are the ones that we should keep blaming on and not the scammer or any other ponzi schemes.

[ultrloa]

Tips:
Researched projects in which you want to invest (DYOR - do your own research) and do not trust anyone blindly, no matter who in your environment is just totally convinced of a project.
Have no unrealistic profit expectations, no one gives you money
If you do not understand a system or project, do not invest in this project.

Some people are already aware on this kind of thing but they do still decide to continue on what they are doing just for the sake of earning easy returns on a short possible of time. Recognizing them isnt really too hard and even just with a simple logic and common sense we can really able to identify out. I dont know why some people do make theirselves of their own greed and they do cry out later when they are scammed. Bitcoinnect shit scam is one of the examples, even just seeing it on very first time it is already a scam to me.

People need to be accountable for their own action and they should put in their minds that research is key of everything but there are so many people are so lazy upon doing it that's why we see so many people cried for their own foolishness, and I agree with hard to detect if the project is scam but their is certain indicator that will slowly shown and it will indicate us to exit before we get slap badly by their faster exit.

[Ca$hmaker]

New Ideas and suggestions are welcome guys to keep this thread alive 

[tweetbit]

If I have smerit on my side I would not hesitate to give one. Nice thread and informative. Keep on sharing that is helpful for each member and you will be given back much prayer for your success.

New Ideas and suggestions are welcome guys to keep this thread alive  

Bump to that.


I definitely wanted to see a post alike this one on the pinned message on any section of this forum. As I have not read one of its kind.

“RISK comes from not knowing what you’re doing.” •Warren Buffett

[Ca$hmaker]

If I have smerit on my side I would not hesitate to give one. Nice thread and informative. Keep on sharing that is helpful for each member and you will be given back much prayer for your success.

New Ideas and suggestions are welcome guys to keep this thread alive  

Bump to that.


I definitely wanted to see a post alike this one on the pinned message on any section of this forum. As I have not read one of its kind.

“RISK comes from not knowing what you’re doing.” •Warren Buffett

Thank you very much buddy 

[stomachgrowls]

Tips:
Researched projects in which you want to invest (DYOR - do your own research) and do not trust anyone blindly, no matter who in your environment is just totally convinced of a project.
Have no unrealistic profit expectations, no one gives you money
If you do not understand a system or project, do not invest in this project.

Some people are already aware on this kind of thing but they do still decide to continue on what they are doing just for the sake of earning easy returns on a short possible of time. Recognizing them isnt really too hard and even just with a simple logic and common sense we can really able to identify out. I dont know why some people do make theirselves of their own greed and they do cry out later when they are scammed. Bitcoinnect shit scam is one of the examples, even just seeing it on very first time it is already a scam to me.

People need to be accountable for their own action and they should put in their minds that research is key of everything but there are so many people are so lazy upon doing it that's why we see so many people cried for their own foolishness, and I agree with hard to detect if the project is scam but their is certain indicator that will slowly shown and it will indicate us to exit before we get slap badly by their faster exit.

For those wise and sensible enough into their own actions and do really keen on investing because they are really careful with their hard earned money then they would most likely do all sorts of things of investigation or researching up.
We do really made our own move and we also the only one would suffer such consequences therefore we should step carefully into things we do seem profitable for us. Mistakes cant be avoided but be careful as you can.

[jakezyrus]

Tips:
Researched projects in which you want to invest (DYOR - do your own research) and do not trust anyone blindly, no matter who in your environment is just totally convinced of a project.
Have no unrealistic profit expectations, no one gives you money
If you do not understand a system or project, do not invest in this project.

Some people are already aware on this kind of thing but they do still decide to continue on what they are doing just for the sake of earning easy returns on a short possible of time. Recognizing them isnt really too hard and even just with a simple logic and common sense we can really able to identify out. I dont know why some people do make theirselves of their own greed and they do cry out later when they are scammed. Bitcoinnect shit scam is one of the examples, even just seeing it on very first time it is already a scam to me.

People need to be accountable for their own action and they should put in their minds that research is key of everything but there are so many people are so lazy upon doing it that's why we see so many people cried for their own foolishness, and I agree with hard to detect if the project is scam but their is certain indicator that will slowly shown and it will indicate us to exit before we get slap badly by their faster exit.

For those wise and sensible enough into their own actions and do really keen on investing because they are really careful with their hard earned money then they would most likely do all sorts of things of investigation or researching up.
We do really made our own move and we also the only one would suffer such consequences therefore we should step carefully into things we do seem profitable for us. Mistakes cant be avoided but be careful as you can.

scams are not only because of investing , we can also get scammed because of joining ico boubty campaigns or sig campaigns . It is hard to avoid scam on an ico bounty but is is easy to avoid scam in an signature campaign that pays in bitcoin because you will know if they are already escrowed the funds or not. While on a bounty ico campaign , they are not using an escrow because the ico need to be finished first after you get your rewards.

[Wahanna]

people are already aware on this kind but one thing they do still decide to continue on what they are doing just for the sake of earning easy returns on a short possible of time. Recognizing them isnt really too hard and even just with a simple logic. They want quickly income.. More high of roi the higher possibility to scam

[Orrechorre]

I agree with your suggestions and they should be very useful especially to newbies who want to invest in a project of campaign. If they take their time to do this research and are very patient and make good decision, it will help. You should also check out for the manager, developer and management team.

[Ca$hmaker]

Tips:
Researched projects in which you want to invest (DYOR - do your own research) and do not trust anyone blindly, no matter who in your environment is just totally convinced of a project.
Have no unrealistic profit expectations, no one gives you money
If you do not understand a system or project, do not invest in this project.

Some people are already aware on this kind of thing but they do still decide to continue on what they are doing just for the sake of earning easy returns on a short possible of time. Recognizing them isnt really too hard and even just with a simple logic and common sense we can really able to identify out. I dont know why some people do make theirselves of their own greed and they do cry out later when they are scammed. Bitcoinnect shit scam is one of the examples, even just seeing it on very first time it is already a scam to me.

People need to be accountable for their own action and they should put in their minds that research is key of everything but there are so many people are so lazy upon doing it that's why we see so many people cried for their own foolishness, and I agree with hard to detect if the project is scam but their is certain indicator that will slowly shown and it will indicate us to exit before we get slap badly by their faster exit.

For those wise and sensible enough into their own actions and do really keen on investing because they are really careful with their hard earned money then they would most likely do all sorts of things of investigation or researching up.
We do really made our own move and we also the only one would suffer such consequences therefore we should step carefully into things we do seem profitable for us. Mistakes cant be avoided but be careful as you can.

scams are not only because of investing , we can also get scammed because of joining ico boubty campaigns or sig campaigns . It is hard to avoid scam on an ico bounty but is is easy to avoid scam in an signature campaign that pays in bitcoin because you will know if they are already escrowed the funds or not. While on a bounty ico campaign , they are not using an escrow because the ico need to be finished first after you get your rewards.

That‘s absolutely right! Bounty Campaigns can also be scams.
But you say it, the only way to know it, is when the ICO is finished.

[Jericka D Ranillo]

Thanks for the tips, well i knew that we need to car3fully the words in a url site. Check it manually if something change in the word like your example binance. There are two dots which the real website doesnt have something like that. I keep it on my mind every i enter in a known crypto website specially on exchanges

[Ca$hmaker]

Yes. Thank you buddy

[SHawk]

Thank you for taking your time to do a very good listing of how to recognize scam in crypto and if this steps are followed carefully, it should help newbies or even some investors who still have problem with scam recognize a good project or coin to invest in or a good campaign to promote and be sure to get reward at the end.

[Honour423]

This is a nice thread.  I would also add prices that are too good to be true and sites that only take crypto as payment.  I'm not a fan of banks and love crypto, but sites that don't take credit cards make it pretty easy to run away with your money.  I'm willing to use crypto on sites that also take credit cards.  It means they were vetted by someone at least. 

[Ca$hmaker]

Let me know if you have some other ideas guys so i'll add them 

[ciang huang]

very rarely if there is a post like this and is very useful for beginners like me, and I can learn to be careful for every transaction, thank you, bro

[pinoyden]

This is a nice thread.  I would also add prices that are too good to be true and sites that only take crypto as payment.  I'm not a fan of banks and love crypto, but sites that don't take credit cards make it pretty easy to run away with your money.  I'm willing to use crypto on sites that also take credit cards.  It means they were vetted by someone at least.  

using credit cards on shady websites are more scary because they could rob your whole bank aside from your cryptos  and also , not all websites are legit even if they accepts credit cards or other payment methods .

Thanks for the tips, well i knew that we need to car3fully the words in a url site. Check it manually if something change in the word like your example binance. There are two dots which the real website doesnt have something like that. I keep it on my mind every i enter in a known crypto website specially on exchanges

thats right . we should always check the correct url and bookmark it so that we are sure that it is the real one , whenever we try to visit and use it . we should also check the domain name ( i.e .com , .io , . eu , .net  , etc ) because some sites have a correct url speling but with different a domain .

[jebul2]

This is a nice thread.  I would also add prices that are too good to be true and sites that only take crypto as payment.  I'm not a fan of banks and love crypto, but sites that don't take credit cards make it pretty easy to run away with your money.  I'm willing to use crypto on sites that also take credit cards.  It means they were vetted by someone at least.  

using credit cards on shady websites are more scary because they could rob your whole bank aside from your cryptos  and also , not all websites are legit even if they accepts credit cards or other payment methods .

Thanks for the tips, well i knew that we need to car3fully the words in a url site. Check it manually if something change in the word like your example binance. There are two dots which the real website doesnt have something like that. I keep it on my mind every i enter in a known crypto website specially on exchanges

thats right . we should always check the correct url and bookmark it so that we are sure that it is the real one , whenever we try to visit and use it . we should also check the domain name ( i.e .com , .io , . eu , .net  , etc ) because some sites have a correct url speling but with different a domain .

so if in your opinion we should be very observant and very careful to enter the same site, your opinion is very true if there are now many fraudsters who duplicate well-known sites like the binance.

[mithrim]

Hi Ca$hmaker,

while I appreciate anyone who makes the effort to spread the word about scams, it would've been really nice of you to give a reference to my original thread, that you just translated with Google translate at that time - 1:1. You could've at least changed the wording appropriately, as I used sayings and phrases that make sense in German but not in English. You also posted in the Italian local forum (https://bitcointalk.org/index.php?topic=5033996), also without any hint that you just copy-pasted with Google translate. I would appreciate if you'd add this information.

Although I prepared an english version myself but didn't post it so far, if you value quality, rewrite the verson you copied so that it fits the respective lnguage, so that we don't have a redundant thread.

And please, also add the sources I used (see bottom).

Hallo zusammen, weil ich es hier immer häufiger gelesen habe, dachte ich mir dass ein Thread zum Thema keine verkehrte Idee wäre (der Post ist WIP). Cryptocurrency Scams werden immer schwieriger zu erkennen. Hier sind ein paar Dinge auf die ihr achten müsst Disclaimer: Die hier gelisteten Scams haben keinen Anspruch auf Vollständigkeit, sind lediglich Beispiele und sollen eine Vorstellung davon vermitteln, auf welche Arten Betrüger (Scammer) versuchen sich Werte zu erschleichen. Da Kryptowährungen wie Bitcoin und Ethereum an Popularität gewinnen, nimmt leider auch die Anzahl an Betrügereien und Scams in diesem Bereich zu. Es gibt jedoch auch einige Dinge, auf die man achten kann (und sollte), wenn man sich auf das Thema einlässt und Geld und/oder persönliche Daten in irgendeiner Form im Spiel sind. Übersicht: (anklickbar) Teil 1 - Webseiten Teil 2 - Twitter Teil 3 - Pyramid und Ponzi Schemes Teil 4 - Airdrops Teil 5 - Signal Groups (Pump & Dump) Teil 6 - Scam-Mails Quellen . Bevor es losgeht, der wichtigste Tipp die Goldene Regel: Gebt NIEMALS eure private Keys (privaten Schlüssel/Adressen) preis, NIEMALS - aus keinem Grund, egal wie verlockend es sein mag! Darüber hinaus: Gier ist einer eurer größten Feinde. Wer gierig ist und einmal zu wenig aufpasst, der kann alles verlieren. Also seid vorsichtig! Teil 1 - Webseiten Situation/Gefahr: Ein mittlerweile beliebter Scam ist das Klonen einer bekannten Webseite, um den ahnungslosen Nutzer dazu zu bringen, seine Daten dort einzugeben und diese zu stehlen. Normalerweise kann man anhand des Vorhandenseins des grünen "https" vor der URL erkennen, ob eine Website legitim ist. Wenn ihr aufmerksam seid könnt ihr leicht erkennen, dass es sich bei der nächsten Seite nicht um eine legitime Site oder eine legitime Entität handelt, da sie nicht über die richtige Zertifizierung verfügt um als vertrauenswürdig eingestuft zu werden. Ihr müsst also immer nach einem grüne "Sicher" oder "Secure" und "https" vor der URL-Adresse der Website Ausschau halten. Dies ist ein Zeichen dafür ist, dass die Website und das Unternehmen die richtigen SSL-Zertifikate (Secure Sockets Layer) erhalten haben. Das Erhalten eines SSL-Zertifikats zeigt, dass das Unternehmen hinter der Seite als vertrauenswürdig eingestuft werden kann. Coinsmarkets.com hat weder das grüne "Secure" noch "https" vor seiner URL-Adresse. Stattdessen hat es ein graues "Not Secure" und ein reguläres "http" vor der URL. In der Regel werden Scam-Seiten schnell erkannt und entfernt. Wenn ihr jetzt versucht coinsmarkets.com zu besuchen (bitte nicht ) erhaltet ihr eine Fehlermeldung. Einige Scam-Seiten haben jedoch einen Wege gefunden, die grünen "Secure" und "https" in der Website-URL-Adresse anzuzeigen und machen dann eine unglaublich subtile Änderung in der URL. Auf den ersten Blick scheint URL für die beliebte Kryptowährungsbörse Binance durchaus legitim. Man kann deutlich das grüne "https" vor der Website-URL erkennen und auch der Name scheint zu stimmen. Es ist in den seltensten Fällen nachvollziehbar, wie eine Seite ein SSL-Zertifikat erhalten hat, das ihnen erlaubt das grüne "https" vor der URL anzeigen zu lassen. Dies gilt genauso für Scammer-Seiten. Gleichzeitig ist es auch ziemlich einfach, ein SSL-Zertifikat von einem weniger seriösen Zertifikatsaussteller zu erhalten. Schaut man sich das 2. Bild genauer an, sieht man kleine Punkte unter den Buchstaben "n" im Wort "binance". Die beiden Punkte unter der Binance-URL zeigen, dass es sich nicht um die echte Binance-Seite handelt. Stattdessen handelt es sich um einen sehr gut gemachten Klon der Seite, der einzig zum Ziel hat, Nutzerdaten abzugreifen, die arglose User dort eingeben. Selbst eine aktivierte 2FA-Authentifikation schützt einen nicht, da ein Scammer diese Daten unmittelbar nach der eigenen Eingabe auf der echten Binance-Seite eingeben kann, wo diese dann noch gültig sind. Somit hat er ab dann Zugriff auf den Account. Besonders perfide sind solche Seiten, die nach dem ersten Login eine Fehlermeldung anzeigen die sinngemäß sagt: "Der Service ist temporär nicht zu erreichen, bitte versuche Sie es in 10 Minuten erneut." Auf diese Weise ahnt der Nutzer nicht mal, dass er gerade seine Daten preisgegeben hat und ein Scammer diese benutzt, um sich Zugriff zum Account des Nutzers zu verschaffen. Versucht der Nutzer sich dann 10 Minuten später erneut einzuloggen, gibt er dem Scammer einen 2. 2FA-Code, den dieser ggf. dazu nutzen kann, eine Transaktion zu veranlassen oder sogar 2FA zu deaktivieren. Selbt wenn ihr aufmerksam seid, kann eine solche Seite schwierig zu erkennen sein, da alles auf den ersten Blick bekannt vorkommt. Bei dem hier gezeigten Beispiel handelt es sich um sog. PunyCode, der dazu verwendet wird, bestimmte Sonderzeichen zu erzeugen (hier den Punkt unter dem Buchstaben "n") In einem anderen Beispiel wurde auf Bittrex verlinkt und das Cedilla unter dem "r" verwendet (sieht wie ein Komma aus). Cedillas sind in Sprachen wie Französisch und Portugiesisch weit verbreitet. Beispiel für PunyCode: Code: müller.de    →  xn--mller-kva übung.de     →  xn--bung-zra.de dömäin.com   →  xn--dmin-moa0i.com äaaa.com     →  xn--aaa-pla.com déjà.vu.com  →  xn--dj-kia8a.vu.com ñandú.com    →  xn--and-6ma2c.com Tipps: Prinzipiell kann man nicht zu 100% sagen, ob eine Seite "echt" ist oder nicht. Es gibt lediglich ein paar Dinge, die man beachten kann. 4 einfache Schritte, mit denen man die meisten Seiten checken kann (sofern es sich um eine etablierte Seite handelt): Google die Seite und guck dir die Ergebnisse an. Am besten nutzt du einen Add-Blocker wie uBlock Origin, damit du nicht aus Versehen auf einen Werbe-Link klickst (beliebte Falle). Die URL auf Vorhandensein von https prüfen. Viele Fake-Seiten nutzen lediglich das http-Protokoll Nachschauen, ob die Verbindung durch den Browser als sicher identifiziert wurde (Schloss muss grün sein). Zusätzlich kann noch auf das Schloss geklickt werden um die Details zu sehen. Die URL selbst checken. Guck dir an, ob Sonderzeichen verwendet wurden bzw. ob PunyCode in der URL zu finden ist. Am besten die URL auch nochmal direkt in die Google-Suche kopieren, wird sie korrigiert ist es ein Fake. Sofern ihr auf einer Seite einen Account habt und diese 2FA anbietet, nutzt es! Die beste Möglichkeit eine Scam-Site zu vermeiden besteht darin, die URL komplett manuell in die Adresszeile des Browsers einzugeben oder ein Bookmark zu verwenden. Es gibt auch Webbrowser-Erweiterungen, die Sie herunterladen können, um Phishing-Betrügereien zu verhindern, die speziell für "Krypto-Enthusiasten" entwickelt wurden, wie die Cryptonight-Erweiterung für Chrome. Seid also stets wachsam und checkt alles was ihr macht doppelt und dreifach. Wenn ihr einen Schritt weiter gehen wollt, könnt ihr auch eine Sandbox nutzen, wenn ihr auf neuen, unbekannten Seiten surfen möchtet. Das schützt euch zwar nicht in dem genannten PunyCode-Fall, allerdings gibt es noch viele weitere potentielle Risiken denen man sich ggf. täglich aussetzt. Teil 2 - Twitter Situation/Gefahr: Eine weitere beliebte Methode ist es, auf Twitter bekannte Accounts zu faken und unter dem Deckmantel eines Giveaways oder eines Airdrops Leute dazu zu animieren, Geld oder Crypto zu senden. Hier sieht man sehr gut, dass im roten Kasten (Scam) zwar der Twitter Name "binance" lautet, das Handle jedoch "@banance_2017" und nicht wie im grünen Kasten "@binance_2017" lautet. Hier wird ein Giveaway von Binance vorgegaukelt und der Link zu einer Ether Adresse angegeben, an die ETH gesendet werden soll, um am Giveaway teilzunehmen. Im orangen Kasten sieht man, dass der Post sehr oft geteilt und geliked wurde, was dem Ganzen Glaubwürdigkeit verleihen soll, ebenso sind die Fake-Bestätigungen in den blauen Kästen gedacht. Diese wurden ebenfalls von den Scammern platziert. Die Hohe Anzahl der Shares & Likes ist sehr wahrscheinlich auf die Nutzung von Bots zurückzuführen. Eine weitere Masche sind Fake Accounts, die sich das "verified" von Twitter inklusive des blauen Hakens neben dem Namen erschleichen, was - wenn man nicht höllisch aufpasst - einen sehr schnell in die Irre führen kann. Hier ein Beispiel: Zu erkennen ist, dass der echte Account des TRON-Projekts (rechts) einen blauen Haken neben dem Namen angezeigt bekommt. Der Handle lautet "@Tronfoundation". Links hingegen ist der Fake Account, dieser hat ebenfalls einen blauen Haken neben dem Namen, jedoch einen leicht anderen Handle "@Tronfoundationl". Hier ist der Tweet in dem TRON vor Fake Accounts warnt. Normalerweise sollte es nicht möglich sein, da Twitter das "verified" nicht jedem vergibt. Hier ist eine Auszug aus der offiziellen Twitter-Beschreibung: Das blaue Verifizierungszeichen  bei Accounts von öffentlichem Interesse auf Twitter zeigt Nutzern, dass der jeweilige Account authentisch ist. Das perfide dara: Der Fake-Account hat die komplett identische Beschreibung, Standort und eine ähnlich hohe Follower-Zahl UND er ist sogar älter, was dazu führt, dass man theoretisch sogar den originalen Account für den Fake-Account hält, da dieser nur wenige Monate alt ist. Sieht man also folgenden Tweet, spricht erstmal wenig dagegen, dass man ihn für authentisch halten kann: Erst wenn man gezielt sucht sieht man, dass es hier Ungereimtheiten gibt: Wie wurde @Tronfoundationl nun verifiziert? Kurzes Scrollen durch den Twitter-Feed lässt darauf schließen, dass die Scammer, die @Tronfoundationl betreiben, das Konto von einer Firma namens LiteracyBridge, einer gemeinnützigen Organisation mit Sitz in Seattle, Washington, übernommen haben. Laut der Gecachten Version der Twitter-Seite und des aktuellen Facebook-Accounts ist LiteracyBridge eine Organisation, die sich auf humanitäre Hilfe konzentriert. Die Scammer scheinen das verifizierte Konto gekapert zu haben und nutzten es, um das Konto der TronFoundation zu fälschen (spoofing). Eigentlich ist dies nicht möglich, denn bei einer Änderung des Nutzernamens verliert ein Account normalerweise automatisch das "verified". Hier ist nun also ebenfalls extreme Vorsicht geboten, denn dem "verifierd by Twitter kann nicht (mehr) getraut werden! Tipps: Macht es euch einfach zum Grundsatz, NIE bei einem Giveaway mitzumachen, bei dem ihr zunächst Geld investieren müsst. Gebt NIEMALS euren private key irgendwo ein und ladet ihn auch nicht hoch (z.B. JSON-Datei). Followed den wichtigsten Twitter-Accounts die ihr regelmäßig nutzt Seht ihr eine Nachricht die euch interessiert, geht in den Twitter-Feed des Account und schaut dort nach, ob die Nachricht wirklich vom echten Account kommt. Teil 3 - Pyramide (Schneeball) und Ponzi Schemes Situation/Gefahr: Bei dem Ponzi-Schema (ähnlich dem Schneeballsystem) handelt es sich um eine vermeintlich lukrative Geldinvestition, die jedoch nur dann "funktionier" wenn kontinuierlich frisches Geld in das System fließt, das meist nur durch neu gewonnene Teilnehmer möglich ist. Das Ponzi-Schema lässt sich anhand verschiedener Faktoren erkennen, u.a. an der garantierten Rendite. Solange neue Investoren hinzukommen, funktioniert das System. In diesem Fall ist ausreichend Kapital zur Auszahlung der bisherigen Investoren verfügbar, solange diese sich nicht zurückziehen und die Investition zurückfordern. Ein sehr bekanntes Beispiel ist BitConnect: BitConnect versprach "Bitcoin-Investing" auf eine andere Ebene zu heben und für jeden zu öffnen. Dafür haben die Macher hinter BitConnect einen eigenen Coin, den BitConnect Coin (BCC), und einige Monate später die BitConnect Lending-Plattform eingeführt. Mit der Plattform konnte in automatisierten Bitcoin-Handel investiert und von täglichen Ausschüttungen profitiert werden. Wie man im folgenden Bild sehr gut sehen kann, sind die Profite bei BitConnect überdurchschnittlich hoch (auch wenn in Crypto die Rendite höher ausfallen kann) - 40% im Monat für eine passive Analge ist unrealistisch. Hier ist sehr gut zu erkennen, was passiert, wenn das System in sich zusammenbricht. Die Gefahr bei diesem Projekt bestand zudem darin, dass viele - auch bekannte - YouTuber, Influencer und Twitterer aktiv für das Projekt geworben und es als ideale Geldquelle dargestellt haben. Warum? Weil sie ihre Referral-Codes genutzt haben und somit für jeden neuen Nutzer belohnt wurden. Am Ende haben die jeweiligen Follower das Vertrauen in denjenigen teuer bezahlt. Tipps: Recherchiert Projekte in die ihr investieren wollt (DYOR - do your own research) und vertraut niemandem blind, egal wer in eurem Umfeld gerade total von einem Projekt überzeugt ist. Habt keine unrealistischen Gewinnerwartungen, keiner schenkt euch Geld Wenn ihr ein System oder Projekt nicht versteht, investiert nicht in dieses Projekt. Teil 4 - Airdrops Situation/Gefahr: Airdrops werden mittlerweile auf verschiedenste Weisen durchgeführt. Daher ist es auch schwierig alle möglichen Scam-Kombinationen aufzuzeigen. Was die meisten Airdrop-Scams geimsam haben ist, dass sie auf irgendeine Art versuchen, an eure private keys zu gelangen - sei es auf einer Webseite oder in einem (Google-)Formular. Prominentes Beispiel ist der Fake-OmiseGo Airdrop: Im obigen Screenshot ist gut zu sehen, dass jeweils im dritten Feld nach eurem private key gefragt wird. Besonders perfide sind die Sätze danach: "Hinweis: Es ist sicher. Wir werden niemals eure persönlichen Daten (wie euren private key) sammeln oder speichern. Dieses Formular ist vollständig verschlüsselt...". Hinzu kommt, dass hier eine unnötige Komplexität suggeriert wird, dabei haben es die Scammer einzig auf euren private key abgesehen. Die Links zu solchen Seiten werden sowohl über Twitter & Facebook aber auch per Telegram und anderen Kanälen wie Slack oder Discord verbreitet. Oft wird ebenfalls noch eine Dringlichkeit suggeriert (z.B. "nur die ersten 1.000 Teilnehmer), damit die vermeintlichen Opfer unvorsichtiger werden. Tipps: Gebt NIEMALS euren private key an! (man kann es nicht oft genug wiederholen ) Wenn ihr bei einem Airdrop mitmachen möchtet, checkt zunächst das Projekt! Nutzt hierzu auf keinen Fall einen direkten Link aus der selben Quelle. Sucht nach einer Homepage und nach einem Bounty Thread hier in Bitcointalk: https://bitcointalk.org/index.php?board=238.0 Findet ihr nichts, ist es sehr wahrscheinlich ein Scam Nutzt euren gesunden Menschenverstand, denn auch hier im Forum gibt es fragwürdige Projekte und Praktiken, wie untenstehendes Beispiel zeigt: https://bitcointalk.org/index.php?topic=2395393.msg24498455#msg24498455 Hier wollte der Airdrop-Veranstalter 0,01 ETH als "Spam-Schutz" bei jedem Airdrop-Teilnehmer erheben, was bei 3.000 Teilnehmern zu 30 ETH geführt hätte. Seid also vorsichtig. Teil 5 - Signal Groups (Pump & Dump) Situation/Gefahr: Sog. Signal Groups bzw. Pump&Dump-Groups sind besonders für Einsteiger eine große Gefahr, da sie schnellen Profit sugerieren und diesen oft auch glaubwürdig präsentieren. 💰 Goal 12 hours: 100% 💰 Goal long-term: 500% Wer würde nicht gerne täglich, wöchentlich oder auch monatlich diesen Profit haben, ohne viel dafür tun zu müssen? Außerdem pumpt die Gruppe ja Coins, die langfristig Zukunft haben (because we care about you), demnach kann man nicht verlieren, richtig? Falsch. Gewinner sind hier nur die Initiatoren des Pumps. In dieser Gruppe sind z.B. 105.000 Mitglieder, alles potentielle Opfer die dafür sorgen, dass sich die Pump&Dump-Gruppe für die Hintermänner lohnt. Hier sind nicht die Gewinnchancen zu sehen, sondern die Chance auf profitable Trades. "Opfer" haben somit 90% Verlust!  Quelle: https://cointrend.de Pump&Dump-Gruppen erscheinen auf den ersten Blick erfolgreich, da sie regelmäßig vermeintliche Gewinne bzw. Gewinnmargen präsentieren und dieser Preisanstieg auch auf den Charts zu sehen ist. Ein unerfahrener Trader ist daher geneigt, den Gewinnversprechungen zu glauben, wobei er jedoch viele andere Faktoren nicht berücksichtigt (pre-pump, accumulation, volume etc.). Wer mehr darüber erfahren möchte, kann hier weiterlesen: https://bitfalls.com/2018/01/12/anatomy-pump-dump-group/ Tipps: Vermeidet kurzfristige Pumps&Dumps, ohne ausgiebige Recherche und Erfahrung ist es reines Glücksspiel und Verluste sind nahezu garantiert. Gebt niemals Geld aus, um in "closed groups" zu kommen oder sog. bezahlte Signale zu erhalten. Ihr kommt in der Regel in den zahlenden äußeren Kreis >> 75% Verlust! Achtet auf vermeintliche "Geheimtipps" die geshillt werden. Hierbei handelt es sich fast immer um Coins die in der Pump-Phase sind. Steigt ihr hier ein, seid ihr diejenigen auf die gedumped wird. Teil 6 - Scam-Mails Situation/Gefahr: Phishing- und Scam-Mails sind ja bereits seit Jahren bekannt und eigentlich auch nichts Neues. Durch die oft herrschende Intransparenz in Crypto und die Ahnunglosigkeit/Unsicherheit vieler ist es trotzdem erwähnenswert. Hinzu kommt, dass Scam Webseiten (s.o.) Accounts/Wallets ggf. unwiderruflich kompromittieren und deswegen eine besondere Gefahr darstellen. Besonders in Kombination mit Airdrops und den oft schwer nachvollziehbaren Praktiken der Coin/token-Verteilung ist die Gefahr von Scam/Phishing-Mails allgegenwärtig. Links eine "klassische" Phishing-Mail, rechts eine Scam-Mail die einen nicht existierenden Airdrop bewirbt: Zu Scam-Mails ist eigentlich nicht viel zu sagen. Sie funktionieren nach dem gleich Prinzip wie bisherige Phishing-Mails und versuchen euch glaubwürdig zu vermitteln, dass sie authentisch sind. Dies wird leider dadurch begünstigt, dass viele Projekte relativ unprofessionell sind und deswegen vermeintliche Scam-Mails tatsächlich manchmal vom eigentlichen Projekt kommen. Dieser Umstand führt dazu, dass es für Laien (und auch erfahrene Nutzer) oft schwierig ist den Unterschied direkt zu erkennen. Tipps: Legt für Crypto mindestens 1 neue E-Mail-Adresse an. Seid selektiv wem ihr diese Adresse gebt. Reagiert niemals auf Mails, die Ihre nicht angefordert habt. Erst recht nicht wenn ihr dem Projekt/Absender nicht auch eure Mail-Adresse gegeben. Klickt auf keine Links in Mails! Solltet ihr es tun, nutzt eine z.B. Sandbox Seid ihr bei einer Mail unsicher, verifiziert die Infos (nicht per Klick in der Mail!), indem ihr z.B. Twitter, Telegram oder andere Social Media Kanäle des Projekts durchsucht. Quellen: [1] - "PunyCode": https://de.wikipedia.org/wiki/Punycode [2] - "uBlockOrigin": https://de.wikipedia.org/wiki/UBlock_Origin [3] - "MetaCert": https://chrome.google.com/webstore/detail/cryptonite-by-metacert/keghdcpemohlojlglbiegihkljkgnige/related [4] - "Sandboxie": https://www.sandboxie.com/ [5] - "Coinmarketcap": https://coinmarketcap.com/ [6] - "Bitconnect, which has been accused of running a Ponzi scheme, shuts down": https://techcrunch.com/2018/01/16/bitconnect-which-has-been-accused-of-running-a-ponzi-scheme-shuts-down/ [7] - "The Anatomy of a Pump & Dump Group": https://bitfalls.com/2018/01/12/anatomy-pump-dump-group/ [8] - "Pump & Dump Scams – Erkennen. Vermeiden.": https://cointrend.de/pump-dump-scams-erkennen-vermeiden/

Hello everybody, because I have read it here more often, I thought that a thread on the subject would not be a wrong idea. Cryptocurrency scams are becoming harder to detect. Here are a few things to watch out for Disclaimer: The scams listed here are not exhaustive, are merely examples, and are intended to give an idea of the ways in which scammers attempt to gain value. As cryptocurrencies such as Bitcoin and Ethereum are gaining in popularity, the number of scams and scams in this area is also increasing. However, there are also some things that you can (and should) pay attention to when dealing with the subject and where money and/or personal information is in any way at stake. Overview: Part 1 - Websites Part 2 - Twitter Part 3 - Airdrops Part 4 - Signal Groups (Pump & Dump) Part 5 - Scam Mails Before you go, the most important tip is the Golden Rule: NEVER reveal your private keys, NEVER - for any reason, no matter how tempting! In addition, greed is one of your biggest enemies. If you are greedy and take too little care of yourself, you can lose everything. So be careful! Part 1 - Websites Situation / Danger: A now popular scam is the cloning of a well-known website to get the unsuspecting user to enter their data and steal it. Usually you can tell by the presence of the green "https" in front of the URL if a website is legitimate. https://ip.bitcointalk.org/?u=https%3A%2F%2Fi.imgur.com%2F3EKZzpt.png&t=588&c=JycNRYO5CG5NAw If you are attentive, you can easily see that the next page is not a legitimate site or a legitimate entity because it does not have the proper certification to be trusted. So you always have to look for a green "Safe" or "Secure" and "https" in front of the URL address of the website. This is a sign that the website and the company have received the proper Secure Sockets Layer (SSL) certificates. Obtaining an SSL certificate indicates that the company can be trusted behind the page. Coinsmarkets.com has neither the green "Secure" nor "https" in front of its URL. Instead, it has a gray "Not Secure" and a regular "http" in front of the URL. As a rule, scam pages are quickly detected and removed. If you are now trying coinsmarkets.com (please do not wink) you will get an error message. However, some scam sites have found a way to display the green "secure" and "https" in the website URL, and then make an incredibly subtle change to the URL. At first glance, URL for the popular cryptocurrency exchange Binance seems legitimate. You can clearly see the green "https" in front of the website URL and also the name seems to be correct. In the rarest cases, it is understandable how a site received an SSL certificate that allows them to display the green "https" in front of the URL. This also applies to scammer pages. At the same time, getting an SSL certificate from a less trusted certificate issuer is pretty easy. If you take a closer look at the second picture, you will see small dots under the letters "n" in the word "binance". The two dots under the Binance URL show that this is not the real Binance page. Instead, it's a very well-made clone of the page, whose sole purpose is to tap user data that unsuspecting users enter there. Even an activated 2FA authentication does not protect you, since a scammer can enter this data immediately after you have entered it on the real Binance page, where it will still be valid. Thus, he has access to the account from then on. Especially perfidious are those pages that show an error message after the first log in, saying: "The service can not be reached temporarily, please try again in 10 minutes." In this way, the user does not even suspect that he has just revealed his data and a scammer uses it to gain access to the user's account. If the user then tries to log back in 10 minutes later, he gives the scammer a 2. 2FA code, which he may use to initiate a transaction or even disable 2FA. Even if you are attentive, such a site can be difficult to spot because everything seems familiar at first glance. The example shown here is called PunyCode, which is used to create certain special characters (here the dot under the letter "n") In another example, we linked to Bittrex and used the cedilla under the "r" (looks like a comma). Cedillas are widely used in languages such as French and Portuguese. Part 2 - Twitter Situation / Danger: Another popular method is to fake known accounts on Twitter and, under cover of a giveaway or airdrop, encourage people to send money or crypto. Here you can see very well that in the red box (Scam) the Twitter name is "binance", but the handle is "@ banance_2017" and not like in the green box "@ binance_2017". Here, a giveaway of Binance is faked and the link to an ether address is given to which ETH is to be sent to participate in the giveaway. In the orange box you can see that the post office has been split and licked very often, which should give the whole thing credibility, as are the fake confirmations in the blue boxes. These were also placed by the scammers. The high number of shares & likes is most likely due to the use of bots. Another scam are fake accounts, which get the "verified" from Twitter including the blue hook next to the name, which - if you are not hellish beware - can lead you astray very quickly. Here's an example: It can be seen that the TRON project's real account (right) has a blue check mark next to its name. The handle is "@Tronfoundation". On the left, however, is the fake account, which also has a blue hook next to the name, but a slightly different handle "@Tronfoundationl". The confusing thing: The fake account has the completely identical description, location and a similar follower number AND he is even older, which means that you theoretically even keep the original account for the fake account, since this is only a few months old. So, if you look at the following tweet, there is not much to say against it that you can consider it authentic: Tips: - Just make it a policy to NEVER join a giveaway where you have to invest money first. - NEVER enter your private key somewhere and do not upload it (eg JSON file). - Followed the most important Twitter accounts you use regularly - If you see a message that interests you, go to the Twitter feed of the account and look there to see if the message really comes from the real account. Part 3 - Airdrops Situation / Danger: Airdrops are now performed in various ways. Therefore, it is also difficult to show all possible scam combinations. What most Airdrop scams have come to grips with is that they somehow try to get hold of your private keys - either on a website or in a (Google) form. Prominent example is the Fake-OmiseGo Airdrop: In the screenshot above it is easy to see that in each case the third field asks for your private key. The following sentences are particularly perfidious: "Note: It is safe We will never collect or store your personal information (such as your private key) This form is fully encrypted ...". In addition, this is an unnecessary complexity suggests, while the scammers have it only on your private key apart. The links to such sites are distributed via Twitter & Facebook but also via telegram and other channels such as Slack or Discord. Often an urgency is also suggested (for example "only the first 1,000 participants), so that the alleged victims become careless. Tips: -NEVER give your private key! (you can not repeat it often enough) -If you want to join in an Airdrop, first check the project! Do not use a direct link from the same source. Looking for a homepage and a bounty thread here in Bitcointalk -If you do not find anything, it is most likely a scam -Use your common sense, because here too in the forum there are questionable projects and practices. Part 4 - Signal Groups (Pump & Dump) Situation / Danger: Undertow. Signal Groups and Pump & Dump Groups are a great danger, especially for newcomers, as they suggest quick profits and often present them credibly. Tips: -Avoid short term pumps & dumps, without extensive research and experience it is pure gambling and losses are almost guaranteed. -Never spend money to get into "closed groups" or receive so-called paid signals. You usually come in the paid outer circle >> 75% loss! -Watch out for supposed "insider tips" that are being dropped. These are almost always coins that are in the pumping phase. If you get in here, you're the one who's dumped on. Part 5 - Scam Mails Situation / Danger: Phishing and Scam emails have been known for years and are actually nothing new. Due to the often prevailing intransparency in Crypto and the unawareness / insecurity of many, it is still worth mentioning. In addition, scam websites (see above) may irreversibly compromise accounts / wallets and therefore pose a particular danger. Especially in combination with Airdrops and the often difficult-to-understand coin-token distribution practices, the danger of scam / phishing emails is omnipresent. On the left a "classic" phishing mail, on the right a scam mail that applies for a nonexistent Airdrop: There is not much to say about scam emails. They work on the same principle as previous phishing emails and try to convince you credibly that they are authentic. This is unfortunately favored by the fact that many projects are relatively unprofessional and therefore supposedly scam mails actually come sometimes from the actual project. As a result, laypersons (and even experienced users) often find it difficult to spot the difference directly. Tips: -Create at least 1 new e-mail address for Crypto. Be selective on whom you give this address. -Never respond to mails that have not requested yours. Especially not if you have not given the project / sender your e-mail address. -Do not click on links in emails! Should you do it, use a e.g. sandbox -If you are unsure about a mail, verify the information (not by clicking in the mail!), Eg. Search the project's Twitter, Telegram, or other social media channels.